Scan for spyware and other potentially unwanted software

With Windows Defender, you can run a quick scan of your computer or a full scan. If you suspect spyware has infected a specific area of your computer, you can customize a scan by selecting only the drives and folders that you want to check.

Watch this video to learn how to scan for spyware and other potentially unwanted software (1:09)

A quick scan checks the places on your computer's hard disk that spyware is most likely to infect. A full scan checks all files on your hard disk and all currently running programs, but it might cause your computer to run slowly until the scan is complete. We recommend that you schedule a daily quick scan. If at any time you think that spyware has infected your computer, run a full scan.
For information about scheduling scans to occur regularly, see Schedule when Windows Defender scans your computer.

You can select specific locations on your computer for Windows Defender to scan. However, if Defender detects spyware or potentially unwanted software, it will then run a quick scan so that the detected items can be removed from other areas of your computer, if needed.

Open Windows Defender by clicking the Start button . In the search box, type Defender, and then, in the list of results, click Windows Defender.

Click the arrow next to the Scan button, and then click Custom scan.

Click Scan selected drives and folders, and then click Select.

Select the drives and folders that you want to scan, and then click OK.

When scanning your computer, you can choose from five additional options:

Scan archive files. Scanning these locations might increase the time required to complete a scan, but spyware and other potentially unwanted software can install itself and attempt to hide in these locations.

Scan e‑mail. Use this option to scan the contents of e‑mail and files that are attached to e‑mail.

Scan removable drives. Use this option to scan the contents of removable drives, such as USB flash drives.

Use heuristics.
Windows Defender uses definition files to identify known threats, but it can also detect and alert you about potentially harmful or unwanted behavior by software that's not yet listed in a definition file. For more information about definition files, see Keep Windows Defender definitions up to date.

Create a restore point. Because you can set Windows Defender to automatically remove detected items, selecting this option allows you to restore system settings in case you want to use software that you didn't intend to remove.

Open Windows Defender by clicking the Start button . In the search box, type Defender, and then, in the list of results, click Windows Defender.

Click Tools, and then click Options.

Click Advanced, select the check box next to each option that you want to use, and then click Save. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

In Windows Defender, you can choose to run a quick scan of your computer or a full system scan. If you suspect spyware has infected a specific area of your computer, you can customize a scan by selecting only the drives and folders that you want to check.

A quick scan checks the places on your computer's hard disk that spyware is most likely to infect. A full scan will check all files on your hard disk and all currently running programs, but it might cause your computer to run slowly until the scan is complete. We recommend that you schedule a daily quick scan. At any time, if you suspect that spyware has infected your computer, run a full scan.

You can select specific locations on your computer for Windows Defender to scan. However, if spyware or other potentially unwanted software is detected, Windows Defender will then run a quick scan so the detected items can be removed from other areas of your computer, if needed.

Open Windows Defender by clicking the Start button , clicking All Programs, and then clicking Windows Defender.

Click the down arrow next to the Scan button, and then click Custom Scan. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

Click Scan selected drives and folders, and then click Select.

Select the drives and folders that you want to scan, and then click OK. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

When scanning your computer, you can choose from four additional options:

Scan the contents of archived files and folders for potential threats. Scanning these locations might increase the time required to complete a scan, but spyware and other potentially unwanted software can install itself and attempt to "hide" in these locations.

Use heuristics to detect potentially harmful or unwanted behavior by software that hasn't been analyzed for risks.
Windows Defender uses definition files to identify known threats, but it can also detect and alert you about potentially harmful or unwanted behavior by software that is not yet listed in a definition file. For more information about definition files, see Keep Windows Defender definitions up to date.

Create a restore point before applying actions to detected items. Because you can set Windows Defender to automatically remove detected items, selecting this option allows you to restore system settings in case you want to use software that you didn't intend to remove.

Do not scan these files or locations. Use this option to select any files and folders that you don't want Windows Defender to scan.

Open Windows Defender by clicking the Start button , clicking All Programs, and then clicking Windows Defender.

Click Tools, and then click Options.

Under Advanced options, select the check box next to each option that you want to use.

If you do not want Windows Defender to scan certain areas of your computer, under Do not scan these files or locations, click Add.

Browse to the files or folders that you do not want to scan, and then click OK. Repeat this step for each file or folder that you do not want to scan.

When you have finished selecting advanced options, click Save. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.